If there's any justification for this kind of delay between detecting an intrusion and acting on it, it would have to be giving the government time to investiga

If there's any justification for this kind of delay between detecting an intrusion and acting on it, it would have to be giving the government time to investigate, in order to correctly identify the source and means of intrusion, so the right parties were charged and innocents weren't dragged in. Which, unfortunately, was not the case with Solarwinds. Almost immediately after the intrusion was publicly disclosed, there were a bunch of stories, in both industry outlets like The Register and mainstream ones as august as the New York Times, suggesting that software from JetBrains might have somehow been implicated in the hack -- citing no evidence other than that Solarwinds had bought JetBrains products, and that they were, y'know... one of them furrin companies (though Czech, not Russian -- one wonders whether the FBI knows the Czech Republic is an EU member these days). https://www.theregister.com/2021/01/07/jetbrains_solarwinds_accusation/ And yet, when a full technical writeup of the way the build servers got breached was available, it turned out that JetBrains software was not at fault; the hack to the build servers worked at a lower level, and switching to a different build orchestrator wouldn't have changed things at all: https://www.crowdstrike.com/blog/sunspot-malware-technical-analysis/ So, extra time to investigate didn't keep the investigators from leaking a report that was just false. JetBrains obviously wasn't well served by this -- but neither were the rest of us.